Active npm supply chain attack in which 14 trojanized packages masquerading as calendar, streak, and math utility libraries deliver RedC2 4.0, an AI-assisted Linux backdoor, via a bundled native binary disguised as a math accelerator (math-core.bin, calc-math.dat, and similar). The malicious module marks the binary executable and launches it as a detached background process on import, so a single transitive dependency reference anywhere in the graph is enough to execute the payload. Affected packages include streak-metrics-math, streak-calc-math, streak-math-metrics, and kit-map-vim.